It looks like disabling IPv6 makes web browsing faster for a lot of people, independently of which operating system is being used. One guy even wrote in one of his posts “In order to fix this problem” . IPv6 was supposed to be a solution, not a problem.

I can think of several rational explanations for the poor user experience. If the DNS query for a web site first returns a AAAA record and you do not have IPv6 running smoothly, the browser will first time out before trying the IPv4 address. If the IPv6 tunnel broker, gateway, etc is overloaded, you are up for a painful experience, too.

However, it is worrying that people need to disable IPv6 on their computers. If and when there will be IPv6-only web sites, they will not be able to access them.

You may be aware that the available pool of IPv4 addresses will be exhausted in 3 years from now. Here are some links to more information.

http://ec.europa.eu/information_society/policy/ipv6/docs/european_day/communication_final_27052008_en.pdf

http://www.ripe.net/news/community-statement.html (and similar announcements form other RIRs)

By way of this e-mail, I wish to formally ask you to make IPv6 support available to your customers.

We are often told that ISPs do not deploy IPv6 on  their network because there is no user demand, so I thought it may be useful to formally ask for it and inform you that I am willing to pay a small extra for a decent IPv6 service.

My own blog post on the subject is here:
http://www.circleid.com/posts/85288_european_commission_pushes_ipv6/

I do not expect any answer, but if it happened, I would post it here.

Update 2 june 10:21am:  The ISP has closed the ticket, without even bothering to reply. Obviously “raising awareness” is  not enough. One of these days, I will have to vote with my feet. The problem of course is that most other Belgian ISPs are even worse …

It is good to see that intergovermental organizations take the lead on this, after 10 years of failure of the private sector to actually deploy IPv6. This is a good example of why governments are needed in the Internet governance arena, be it the IGF or the GAC in ICANN.

Quick and dirty fixes like NATs allow for small investments and high short-term returns. This is what most CEOs in the Internet industry are concerned with,  because they risk to get fired if they do not provide a good and quick return to shareholders. When a long term and societal vision is needed, governments become key leading partners.

It is true that these governments also include a bunch of “supreme guides of the people’s revolution” and other sorts of autocrats and dictators. Indeed, they censor and control their local Internet. These are the same people who control other media like TV or the written press. There is nothing new under the sun, and I still do not understand some in the Internet community who like us to think the Net is different from other media and that the (bad) rules do not apply.

This is why we need the increased presence of democratic governments in Internet governance circles. Unfortunately, the current ideology in democratic countries is to let the private sector do whatever it  wants, with little political support. Not-so-democratic governments, on the contrary, tend to be very active. The end result, as we see in the IGF, is that the latter come up with requests that neither the private sector nor the “civil society” (whatever that means) can counter, because they lack the political weight. A good dictator knows the best way to silence the private sector is to become one of its customers, because no company wants to loose business.  Which leads us back to paragraph 3 above.

"Congratulations ! You're using IPv6 ! Your address is XXXXXXX"

In case you ask, the PHP code that performs this check is below:

Update: Martin J. Levy suggested the following, more compact code:

I have tried both SQLGrey and Policyd. They work, to a degree, but are not yet as smart as they are on the IPv4 side.

Typically, it should automatically white list entire /64s for IPv6, just like it white lists /24s on IPv4. If they support either PostgreSQL or MySQL, it is even better.

Any suggestions welcome.

The web interface my registrar (Gandi) uses does not allow IPv6 addresses. Their support desk informed me that they do not yet handle IPv6 addresses in their web forms.

There is obvious workarounds, of course. One is to assign both a IPv4 and a IPv6 address to the DNS server, as long as it is in under another domain. However, if the DNS server is under the same domain, a glue record would need to be inserted in the TLD zone file. This is currently not possible, at least with the tools provided to the average domain name user.

I am really looking forward to the IPv6 workshop that ALAC is planning at the Paris meeting of ICANN next June and see with other constituencies how these showstoppers can be addressed.

This decision will greatly help in the transition to IPv6, especially for large companies or ISPs. Until now, companies wishing to use IPv6 were barred from multihoming their Internet connection. This was particulary an issue for smaller ISPs. For any company relying on the Internet for its business, global IPv6 reachability is an important factor. However, peering agreements between Internet transit providers are often better optimized in the IPv4 world than they are in the IPv6 one. Consequently, mutihoming the connection greatly enhances their reachability.

Obviously, a large corporate network cannot afford to renumber every time it switches ISPs. It does have a substantial cost. A corporation would think twice before switching ISPs. This prevents competition.
Neither can a corporation use multihoming with two or more ISPs in the current scenario, because an address block assigned to ISP A cannot be routed through ISP B. Again, this is hampering competition.

For those needing multihoming, which includes potentially every business whose operations on the Internet are critical, the current RIPE policy is clearly detrimental.

It is difficult to escape the feeling that this policy was set up by the ISPs in order to protect their business interests. Those ISPs form the vast majority of the RIPE NCC members and the majority of those attending RIPE meetings. Maybe larger end users could attend those meetings, too. However, most companies do not have the time or resources to send someone to such meetings.

A proposal by Jordi Palet Martinez, the well-known white knight of IPv6, aims at addressing this issue. It is still unclear at this stage if the proposal will go through. However the RIPE community will find it difficult to resist the pressure. ARIN, the American Regional registry is already assigning provider-independent /48 s to companies willing to “pay” for it.

I know it is quite blasphemous to talk about “paying” and “owning” IP address blocks in the RIR community. Yet, some companies have been using the same IPv4 address blocks for the last 20 years or so. They expect the same stability in the IPv6 world. They look at it as their property, in a way. I am even sure a lawyer could argue that what you have been using for 20 years, without anyone objecting, can reasonably be considered your property.

Unfortunately, we are not there yet. Good try, maybe next time.

hiram:~ patrick$ host sanjuan2007.icann.org
sanjuan2007.icann.org is an alias for ganges.lax.icann.org.
ganges.lax.icann.org has address 208.77.191.173

hiram:~ patrick$ dig ganges.lax.icann.org AAAA
; <<>> DiG 9.3.4 <<>> ganges.lax.icann.org AAAA
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13528
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;ganges.lax.icann.org. IN AAAA

Still, congratulations to ICANN for the work they have done to make information more accessible on the web. The only missing piece now is an ICS file to be able to import the meeting schedules directly in our computer or PDA.

So, rather than telling others that they should run DNSSEC, I figured I should do my homework and run DNSSEC myself, without waiting for my TLDs to get signed.

The job is done, but it was no easy task. If you are looking for a simple button on a GUI to sign your DNS zones, move on. Currently, this is not for the faint of heart, which might explain the slow adoption path. Bind does include all the tools, but you first have to figure out how the damn thing works and use the right parameters.

I found a tool which made my life much easier. It is called ZKT. Once you have configured the header files to your environment and adapted your file directory structure to the requisites of ZKT, you can actually sign all your zones in one pass. It will call the necessary Bind tools with the right parameters. I have created a cron job that will periodically check which signatures need updating and change the zone files accordingly. Highly recommended.